Privacy Policy

DealHubble, Inc. ("DealHubble," "we," "us," or "our") is a Delaware-incorporated technology company that operates a broker-centric vehicle deal marketplace platform. This Privacy Policy describes the categories of information we collect, how we use and share that information, and the rights available to consumers and other users of our platform.

This Privacy Policy applies to information we collect through our website at dealhubble.com, our broker and dealer platform, our partner APIs, and any related communications. It does not apply to the practices of third-party websites or services that we do not own or control.

Please read this Privacy Policy carefully. By accessing or using our services, you agree to the collection, use, and sharing of your information as described in this Privacy Policy.

1. Information We Collect

We collect information from and about brokers, dealers, consumers whose vehicle deals are facilitated through brokers using our platform, and visitors to our website. The categories of information we collect depend on how you interact with us.

1.1 Information Brokers Provide

• Account information, including name, email address, phone number, business name, brokerage license number, and state of operation.
• Authentication credentials, including hashed passwords and multi-factor authentication tokens.
• Client and deal information that brokers submit on behalf of their consumer clients, including vehicle requests, financing preferences, and deal terms.
• Communications with us, including support requests and feedback.

1.2 Information Dealers Provide

• Account information, including dealership name, address, franchise brand, contact persons, and dealer license information.
• Inventory and offer data, including vehicle pricing, terms, fees, and incentives submitted to compete on broker requests.
• Performance data generated through use of the platform, including response times and deal completion outcomes.

1.3 Consumer Information We Receive From Brokers and Partners

Brokers and, in the future, lender or insurance partners may share consumer information with DealHubble in order to facilitate a vehicle transaction. This information may constitute Nonpublic Personal Information ("NPI") under the Gramm-Leach-Bliley Act and may include:

• Identifiers, including name, postal address, email address, telephone number, and date of birth.
• Financial information, including credit score tier, income range, financing preferences, trade-in vehicle data, and deal terms.
• Vehicle preferences, including make, model, trim, configuration, and target price.
• Government-issued identifiers, only when required for a specific lender integration and only with consumer consent.

1.4 Information We Collect Automatically

• Log and device data, including IP address, browser type, device type, operating system, referring URLs, pages viewed, and timestamps.
• Usage data, including features accessed, actions taken on the platform, and session duration.
• Cookies and similar technologies (see Section 6).

1.5 Information From Other Sources

• Public business records, including dealer license registries, used to verify dealer accounts.
• Service providers and partners that help us operate the platform.

We do not purchase consumer data from data brokers for marketing purposes.

2. How We Use Information

We use the information we collect for the following purposes, each tied to a legitimate business need or legal obligation:

• To operate the platform, including creating broker and dealer accounts, routing vehicle requests, normalizing dealer offers, presenting comparisons, and tracking deals through completion.
• To verify identity and prevent fraud, including authenticating users, validating dealer franchise eligibility, and detecting suspicious activity.
• To communicate with users, including transactional notifications about deals, account-related messages, and responses to support requests.
• To improve the platform, including measuring feature performance, training internal scoring models, and conducting analytics on platform health.
• To provide pricing intelligence, including aggregating and de-identifying transaction data to produce market insights. We do not sell or disclose individual consumer NPI for this purpose without separate consent.
• To comply with legal obligations, including responding to lawful requests, defending against legal claims, and meeting record-keeping requirements under applicable law.
• To protect rights and safety, including enforcing our terms of service and protecting the security and integrity of the platform.

2.1 Use of Artificial Intelligence

DealHubble uses artificial intelligence to support specific platform functions, including parsing unstructured dealer offers into structured data, scoring deal quality, and routing requests. Anthropic is our primary AI provider and OpenAI serves as a fallback provider. When unstructured offer text is sent to a third-party AI provider for parsing, we strip or pseudonymize identifying information before transmission, and we do not transmit consumer NPI to AI providers without a data processing agreement that prohibits use of the data for model training. We document and review automated decision-making processes that materially affect a consumer in accordance with applicable law.

2.2 SMS / Text Message Notifications

With your prior express consent, DealHubble sends transactional SMS/text messages to brokers about their account and active deals — for example, alerts that a new dealer offer has been received or that a deal's status has changed. We do not send marketing or promotional text messages. Consent to receive SMS notifications is optional and is not a condition of creating an account or using the platform.

We do not share mobile numbers with third parties for their own marketing. Mobile numbers collected for SMS notifications are used only to deliver the transactional notifications described above and are processed on our behalf by our SMS delivery sub-processor (Twilio), as described in Section 3.1.

Message frequency varies based on your account activity and the deals you have in progress. Message and data rates may apply, depending on your mobile carrier and plan.

You may opt out of SMS notifications at any time by replying STOP to any DealHubble text message; we will send a single confirmation and then stop sending SMS notifications to that number. Reply HELP to any DealHubble text message for assistance, or contact us using the information in Section 8. Opting out of SMS notifications does not affect email or in-platform notifications, which continue to operate independently.

3. How We Share Information

We do not sell consumer NPI. We share information only as described in this Section.

3.1 With Sub-Processors

We rely on a small set of trusted technology vendors to operate the platform. These vendors process data on our behalf under written data processing agreements that restrict their use of the data to providing services to DealHubble.

Sub-Processor	Service	Data Categories
Supabase	Managed Postgres database, authentication	All platform data, including consumer NPI, deal records, audit logs
Vercel	Application hosting and deployment	Application requests, sanitized logs, environment configuration
Trigger.dev	Background job orchestration	Job payloads referencing deal and request identifiers
SendGrid	Transactional email delivery	Email addresses and notification content
Twilio	SMS notification delivery	Phone numbers and SMS content
Anthropic	Primary AI offer parsing, deal scoring, and routing	Offer text with NPI stripped or pseudonymized
OpenAI	Fallback AI offer parsing and supporting workflows	Offer text with NPI stripped or pseudonymized
Stripe	Subscription billing and payment collection	Broker billing name and address; payment-method tokens (not raw card data)

A current list of sub-processors and their certifications is maintained in our Vendor Risk Register and is available on request.

3.2 With Lender Partners

When a broker or consumer elects to seek financing through a lender partner integrated with DealHubble, we share the information necessary to facilitate that financing referral or pre-qualification, such as identifying information and deal terms. We share this information only after the consumer is notified and has provided the consent required by applicable law. Lender partners are bound by separate Data Use Agreements that restrict their use of the data to the financing purpose for which it was shared.

3.3 With Insurance and F&I Partners

When a broker or consumer elects to consider GAP insurance, vehicle service contracts, or other ancillary products through an integrated insurance or F&I partner, we share only the information necessary to enable the partner to present a quote or proposal. Consumer consent is obtained at the point of selection, and we maintain records of that consent for audit purposes.

3.4 With Brokers and Dealers

Information that brokers and dealers exchange in the course of a vehicle transaction is shared between the parties to that transaction as necessary to facilitate the deal. Brokers see structured offer comparisons and dealer reputation indicators. Dealers see relative competitive positioning but do not see other dealers' identities or pricing.

3.5 For Legal Reasons

• To comply with applicable law, regulation, legal process, or governmental request.
• To enforce our terms of service or other agreements.
• To protect the rights, property, and safety of DealHubble, our users, or others.
• In connection with a corporate transaction, such as a merger, acquisition, financing, or sale of assets, subject to commercially reasonable confidentiality protections.

3.6 With Your Consent

We share information for any other purpose described to you at the time of collection or with your consent.

4. Consumer Rights Under California Law

If you are a California resident, you have the following rights under the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA"):

• Right to Know. You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties with whom we have shared the information.
• Right to Delete. You may request that we delete personal information we have collected about you, subject to certain exceptions (such as information we are required to retain to comply with legal obligations).
• Right to Correct. You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing. We do not sell consumer NPI and we do not share consumer NPI for cross-context behavioral advertising. If our practices change, we will provide an opt-out mechanism in accordance with law.
• Right to Limit Use of Sensitive Personal Information. You may request that we limit the use of your sensitive personal information to purposes specified by the CPRA.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights.

We will respond to verifiable consumer requests within forty-five (45) days, with the option to extend by an additional forty-five (45) days where reasonably necessary, with notice to you. To exercise any of these rights, contact us at the address in Section 8.

4.1 Authorized Agents

You may designate an authorized agent to make a request on your behalf. We may require the agent to provide proof of authorization and may require you to verify your identity directly with us.

4.2 Other State Privacy Rights

Residents of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, and Montana) have rights similar to those described above. We honor those rights in accordance with the applicable law of your state of residence.

5. Data Retention

We retain personal information for the periods specified in our Data Retention Policy (Document DH-POL-005), which align with our legal, regulatory, contractual, and operational obligations. The principal retention periods are summarized below:

Category	Retention Period
Consumer NPI tied to a completed deal	7 years from deal completion
Deal records	7 years from deal completion
Offer records	5 years from request creation
Audit logs	12 months active, archived for 3 years
Broker account data	Duration of account plus 3 years
Dealer account data	Duration of account plus 3 years
API access logs	12 months rolling
Consent records	Duration of relationship plus 7 years

Where you exercise a right of deletion, we will delete or de-identify the relevant information and instruct our sub-processors to do the same, except where retention is required by law (for example, to maintain audit trails, defend against legal claims, or comply with tax and financial recordkeeping obligations).

6. Cookies and Tracking Technologies

We use cookies and similar technologies to operate, secure, and improve our platform. Cookies are small text files placed on your device when you visit our website.

6.1 Categories of Cookies We Use

• Strictly Necessary Cookies. Required for the platform to function, including authentication and session management. These cannot be disabled without breaking core functionality.
• Functional Cookies. Remember user preferences, such as display options.
• Analytics Cookies. Help us understand how the platform is used so we can improve it. We do not use analytics cookies to build advertising profiles.

We do not use third-party advertising cookies and we do not participate in cross-context behavioral advertising. You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent the platform from functioning.

6.2 Do Not Track

Because there is no industry-standard interpretation of "Do Not Track" signals, our platform does not currently respond to Do Not Track signals. We will update this Policy if a standard is widely adopted.

7. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, alteration, and disclosure. These safeguards include encryption in transit and at rest, multi-factor authentication for administrative access, Row Level Security on databases containing consumer information, audit logging on sensitive operations, and ongoing personnel training. Our practices are documented in our Written Information Security Program (Document DH-POL-001), maintained in accordance with the GLBA Safeguards Rule.

No system is perfectly secure. If you have reason to believe that your interaction with DealHubble is no longer secure, contact us immediately using the information in Section 8.

8. Contact Us

To exercise your privacy rights, ask questions about this Privacy Policy, or report a privacy concern, contact us at:

Company	DealHubble, Inc.
Privacy Contact	contact@dealhubble.com
Mailing Address	DealHubble, Inc. — Privacy Office (address on file with Delaware Division of Corporations)
Response Time	Within 45 days of a verifiable request

9. Children's Privacy

Our platform is not directed to children under the age of sixteen (16), and we do not knowingly collect personal information from children. If we learn that we have collected personal information from a child without verifiable parental consent, we will delete that information.

10. International Users

DealHubble is based in the United States and our platform is intended for use by brokers, dealers, and consumers in the United States. If you access the platform from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this Policy and, where appropriate, provide additional notice (such as by email to broker or dealer users). Your continued use of the platform after the effective date of an update constitutes your acceptance of the updated Policy. Prior versions of this Policy are retained for audit purposes and are available on request.